by Kastro
Paper/Archive/CVE-2026-84639

CVE-2026-84639

Mozilla Thunderbird — Uninitialized memory in MIME parsing

EPSS 0.3%CVSS 9.1
critical.is priorityof 100
32
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 25.3.253 × 205.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Affected

ProductAffectedFixed inSource
Thunderbirdsee advisory140.15CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refbugzilla.mozilla.org/show_bug.cgi?id=2061087refmozilla.org/security/advisories/mfsa2026-86refmozilla.org/security/advisories/mfsa2026-87refmozilla.org/security/advisories/mfsa2026-88